{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/cloazk-warden-v1.json",
  "title": "CLOAzK Warden Disposition Receipt, v1",
  "description": "Canonical schema for the Hive CLOAzK Warden disposition receipt, canonical type cloazk.warden. The body admits commitments and counts and nothing else, so non-possession of the underlying observation is structural rather than promised. Every object level sets additionalProperties false, and observation_accounting fixes content_released to false and content_commitment_only to true. does_not_prove: this receipt does not prove the observations existed, does not prove the Warden was honest, and does not release or attest to any image, audio, or video content.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": { "type": "string", "pattern": "^r_cloazk\\.warden_[0-9]{10,}_[0-9a-f]{12}$" },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "disposition_id",
        "machine_commitment",
        "warden_commitment",
        "evaluated_at",
        "window_start",
        "window_end",
        "policy",
        "posture_commitment",
        "posture_proof",
        "observation_accounting",
        "checks",
        "within_policy_count",
        "outside_policy_count",
        "not_evaluable_count",
        "disposition",
        "disclosure_class",
        "verdict",
        "salt_commitment",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "cloazk.warden" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "disposition_id": { "type": "string", "pattern": "^cw_[0-9a-f]{16,64}$" },
        "machine_commitment": {
          "type": "string",
          "description": "Salted HMAC over the machine serial. The serial itself never enters the receipt.",
          "pattern": "^[0-9a-f]{64}$"
        },
        "warden_commitment": {
          "type": "string",
          "description": "Salted HMAC over the Warden identifier, so the evaluating component stays private inside the operator boundary.",
          "pattern": "^[0-9a-f]{64}$"
        },
        "evaluated_at": {
          "type": "string",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$"
        },
        "window_start": {
          "type": "string",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$"
        },
        "window_end": {
          "type": "string",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$"
        },
        "policy": {
          "type": "object",
          "description": "The named policy the Warden evaluated the posture against.",
          "required": ["policy_id", "policy_commitment", "policy_version"],
          "additionalProperties": false,
          "properties": {
            "policy_id": { "type": "string", "pattern": "^wp_[a-z0-9_.-]{3,64}$" },
            "policy_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "policy_version": { "type": "string", "pattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+$" }
          }
        },
        "posture_commitment": {
          "type": "string",
          "description": "Salted HMAC over the canonical posture vector. The vector itself is never carried.",
          "pattern": "^[0-9a-f]{64}$"
        },
        "posture_proof": {
          "type": "object",
          "description": "The commitment style proof of the posture, bound to this policy and this window.",
          "required": ["scheme", "proof_commitment", "statement_commitment"],
          "additionalProperties": false,
          "properties": {
            "scheme": {
              "type": "string",
              "enum": ["hmac_commitment_v1", "spectralzk_v1"]
            },
            "proof_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "statement_commitment": {
              "type": "string",
              "description": "Recomputed by the service over the policy commitment, the posture commitment, and both window bounds, so a proof cannot be lifted from one window and pasted into another.",
              "pattern": "^[0-9a-f]{64}$"
            }
          }
        },
        "observation_accounting": {
          "type": "object",
          "description": "How many observations were consulted and of what class. Content is never released and only commitments leave the operator boundary, which is why both flags are fixed constants rather than caller supplied booleans.",
          "required": [
            "observation_count",
            "observation_classes",
            "content_released",
            "content_commitment_only"
          ],
          "additionalProperties": false,
          "properties": {
            "observation_count": { "type": "integer", "minimum": 0, "maximum": 100000000 },
            "observation_classes": {
              "type": "array",
              "minItems": 1,
              "maxItems": 6,
              "items": {
                "type": "string",
                "enum": [
                  "rgb_frame",
                  "depth_frame",
                  "audio_frame",
                  "pose_sample",
                  "force_sample",
                  "proximity_sample"
                ]
              }
            },
            "content_released": { "type": "boolean", "const": false },
            "content_commitment_only": { "type": "boolean", "const": true }
          }
        },
        "checks": {
          "type": "array",
          "description": "One entry per policy check the Warden ran. Outcomes only, never observations.",
          "minItems": 1,
          "maxItems": 64,
          "items": {
            "type": "object",
            "required": ["check_id", "outcome"],
            "additionalProperties": false,
            "properties": {
              "check_id": { "type": "string", "maxLength": 64, "pattern": "^ck_[a-z0-9_.-]{3,64}$" },
              "outcome": {
                "type": "string",
                "enum": ["within_policy", "outside_policy", "not_evaluable"]
              }
            }
          }
        },
        "within_policy_count": {
          "type": "integer",
          "description": "Recomputed by the service from the checks whose outcome is within_policy.",
          "minimum": 0,
          "maximum": 64
        },
        "outside_policy_count": {
          "type": "integer",
          "description": "Recomputed by the service from the checks whose outcome is outside_policy.",
          "minimum": 0,
          "maximum": 64
        },
        "not_evaluable_count": {
          "type": "integer",
          "description": "Recomputed by the service from the checks whose outcome is not_evaluable.",
          "minimum": 0,
          "maximum": 64
        },
        "disposition": {
          "type": "string",
          "description": "Recomputed by the service from the check outcomes.",
          "enum": ["posture_within_policy", "posture_outside_policy", "posture_not_evaluable"]
        },
        "disclosure_class": {
          "type": "string",
          "description": "Fixed. A cloazk.warden receipt has exactly one disclosure posture and it is not negotiable.",
          "const": "commitment_only_no_content_released"
        },
        "verdict": {
          "type": "string",
          "description": "Recomputed by the service from the disposition. The ceiling is posture_attested_without_content_release.",
          "enum": [
            "posture_attested_without_content_release",
            "posture_violation_attested_without_content_release",
            "posture_not_established"
          ]
        },
        "salt_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
        "boundary": {
          "type": "string",
          "minLength": 1,
          "const": "This receipt records that a Warden evaluated a machine's posture against a named policy inside the operator's own boundary, and carries a zero knowledge style commitment to the posture rather than the underlying observations. It does not prove the observations existed, does not prove the Warden was honest, and does not release or attest to any image, audio, or video content."
        }
      }
    }
  }
}